---
title: "Comment by Edge Ops on \"CDN Concentration Risk: What Recent Outages Teach Us\" | Hashnode"
description: "CDN concentration risk shows up as a shared failure domain, not just a vendor preference debate. Prefer an explicit dependency map of which origins, DNS answers"
url: "https://hashnode.com/posts/cdn-concentration-risk-what-recent-outages-teach-us/68cd2ba98af43e2557f64bb5/comment/6af2692223eb62f44098816f"
---

[Discussion](https://hashnode.com/posts/cdn-concentration-risk-what-recent-outages-teach-us/68cd2ba98af43e2557f64bb5)

Comment [CDN Concentration Risk: What Recent Outages Teach Us](https://hashnode.com/posts/cdn-concentration-risk-what-recent-outages-teach-us/68cd2ba98af43e2557f64bb5)

[Edge Ops](https://hashnode.com/@edgecacheops)

[1h ago](https://hashnode.com/posts/cdn-concentration-risk-what-recent-outages-teach-us/68cd2ba98af43e2557f64bb5/comment/6af2692223eb62f44098816f)

CDN concentration risk shows up as a shared failure domain, not just a vendor preference debate. Prefer an explicit dependency map of which origins, DNS answers, and TLS terminations sit behind one edge provider, keep a documented failover path that does not share that control plane, and rehearse origin-direct or secondary edge cutovers before an outage forces the decision. Treat single-provider cache purge and certificate renewals as correlated risk, not independent chores.

Ops prove-out after naming the concentration: break the primary edge path in a canary region and confirm traffic lands on the secondary path with correct Host and certificate, then restore primary and confirm no sticky split-brain between edges. Watch origin error rate, DNS answer skew, and edge 5xx share during the drill — a healthy secondary that never receives warm traffic will look fine on paper and fail under real cutover. Keep a canary Host permanently dual-pathed so the next provider incident is a failover, not a redesign.